Merge staging-next into staging

ci/github-script/labels.js

···
               'assigned',
               'commented', // uses updated_at, because that could be > created_at
               'committed', // uses committer.date
+              ...(item.labels.some(({ name }) => name === '5.scope: tracking')
+                ? ['cross-referenced']
+                : []),
               'head_ref_force_pushed',
               'milestoned',
               'pinned',

nixos/modules/hardware/fw-fanctrl.nix

···
         Additional config entries for the fw-fanctrl service (documentation: <https://github.com/TamtamHero/fw-fanctrl/blob/main/doc/configuration.md>)
       '';
       type = lib.types.submodule {
-        freeformType = configFormat.type;
+        freeformType = lib.types.attrsOf configFormat.type;
         options = {
           defaultStrategy = lib.mkOption {
             type = lib.types.str;

nixos/modules/programs/openvpn3.nix

···
     options
     lists
     ;
-  inherit (lib.types) bool submodule ints;
+  inherit (lib.types)
+    bool
+    submodule
+    ints
+    attrsOf
+    ;
 in
 {
   options.programs.openvpn3 = {
···
             description = "Options stored in {file}`/etc/openvpn3/netcfg.json` configuration file";
             default = { };
             type = submodule {
-              freeformType = json.type;
+              freeformType = attrsOf json.type;
               options = {
                 systemd_resolved = mkOption {
                   type = bool;
···
             description = "Options stored in {file}`/etc/openvpn3/log-service.json` configuration file";
             default = { };
             type = submodule {
-              freeformType = json.type;
+              freeformType = attrsOf json.type;
               options = {
                 journald = mkOption {
                   description = "Use systemd-journald";

nixos/modules/security/agnos.nix

···
       inherit (lib) types mkOption;
     in
     types.submodule {
-      freeformType = format.type;
+      freeformType = types.attrsOf format.type;
 
       options = {
         email = mkOption {
···
       inherit (lib) types literalExpression mkOption;
     in
     types.submodule {
-      freeformType = format.type;
+      freeformType = types.attrsOf format.type;
 
       options = {
         domains = mkOption {
···
       settings = mkOption {
         description = "Settings";
         type = types.submodule {
-          freeformType = format.type;
+          freeformType = types.attrsOf format.type;
 
           options = {
             dns_listen_addr = mkOption {

nixos/modules/services/admin/meshcentral.nix

···
         - [Old homepage with documentation link](https://www.meshcommander.com/meshcentral2)
       '';
       type = types.submodule {
-        freeformType = configFormat.type;
+        freeformType = attrsOf configFormat.type;
       };
       example = {
         settings = {

nixos/modules/services/networking/bind.nix

···
         '';
       };
 
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Additional command-line arguments to pass to named.
+        '';
+        example = [
+          "-n"
+          "4"
+        ];
+      };
+
       configFile = lib.mkOption {
         type = lib.types.path;
         default = confFile;
···
 
       serviceConfig = {
         Type = "forking"; # Set type to forking, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900788
-        ExecStart = "${bindPkg.out}/sbin/named ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile}";
+        ExecStart = "${bindPkg.out}/sbin/named ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} ${lib.concatStringsSep " " cfg.extraArgs}";
         ExecReload = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' reload";
         ExecStop = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
         User = bindUser;

nixos/modules/services/networking/tailscale.nix

···
       description = ''
         A file containing the auth key.
         Tailscale will be automatically started if provided.
+
+        Services that bind to Tailscale IPs should order using {option}`systemd.services.<name>.after` `tailscaled-autoconnect.service`.
       '';
     };
 
···
 
     extraUpFlags = mkOption {
       description = ''
-        Extra flags to pass to {command}`tailscale up`. Only applied if `authKeyFile` is specified.";
+        Extra flags to pass to {command}`tailscale up`. Only applied if {option}`services.tailscale.authKeyFile` is specified.
       '';
       type = types.listOf types.str;
       default = [ ];
···
       wants = [ "tailscaled.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        Type = "oneshot";
+        Type = "notify";
       };
-      # https://github.com/tailscale/tailscale/blob/v1.72.1/ipn/backend.go#L24-L32
+      path = [
+        cfg.package
+        pkgs.jq
+      ];
+      enableStrictShellChecks = true;
       script =
         let
-          statusCommand = "${lib.getExe cfg.package} status --json --peers=false | ${lib.getExe pkgs.jq} -r '.BackendState'";
           paramToString = v: if (builtins.isBool v) then (lib.boolToString v) else (toString v);
           params = lib.pipe cfg.authKeyParameters [
             (lib.filterAttrs (_: v: v != null))
···
             (params: if params != "" then "?${params}" else "")
           ];
         in
+        # bash
         ''
-          while [[ "$(${statusCommand})" == "NoState" ]]; do
-            sleep 0.5
+          getState() {
+            tailscale status --json --peers=false | jq -r '.BackendState'
+          }
+
+          lastState=""
+          while state="$(getState)"; do
+            if [[ "$state" != "$lastState" ]]; then
+              # https://github.com/tailscale/tailscale/blob/v1.72.1/ipn/backend.go#L24-L32
+              case "$state" in
+                NeedsLogin)
+                  echo "Server needs authentication, sending auth key"
+                  tailscale up --auth-key "$(cat ${cfg.authKeyFile})${params}" ${escapeShellArgs cfg.extraUpFlags}
+                  ;;
+                Running)
+                  echo "Tailscale is running"
+                  systemd-notify --ready
+                  exit 0
+                  ;;
+                *)
+                  echo "Waiting for Tailscale State = Running or systemd timeout"
+                  ;;
+              esac
+            fi
+            echo "State = $state"
+            lastState="$state"
+            sleep .5
           done
-          status=$(${statusCommand})
-          if [[ "$status" == "NeedsLogin" || "$status" == "NeedsMachineAuth" ]]; then
-            ${lib.getExe cfg.package} up --auth-key "$(cat ${cfg.authKeyFile})${params}" ${escapeShellArgs cfg.extraUpFlags}
-          fi
         '';
     };
 

nixos/modules/services/security/oauth2-proxy-nginx.nix

···
         virtualHosts.${vhost} = {
           locations = {
             "/".extraConfig = ''
+              auth_request_set $user   $upstream_http_x_auth_request_user;
+              auth_request_set $email  $upstream_http_x_auth_request_email;
+              auth_request_set $auth_cookie $upstream_http_set_cookie;
+
               # pass information via X-User and X-Email headers to backend, requires running with --set-xauthrequest flag
               proxy_set_header X-User  $user;
               proxy_set_header X-Email $email;
···
           extraConfig = ''
             auth_request /oauth2/auth;
             error_page 401 = @redirectToAuth2ProxyLogin;
-
-            # set variables being used in locations."/".extraConfig
-            auth_request_set $user   $upstream_http_x_auth_request_user;
-            auth_request_set $email  $upstream_http_x_auth_request_email;
-            auth_request_set $auth_cookie $upstream_http_set_cookie;
           '';
         };
       }) cfg.virtualHosts)

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

···
         available_version = available_match.group(1)
 
         if installed_version < available_version:
-            print("updating systemd-boot from %s to %s" % (installed_version, available_version))
+            print("updating systemd-boot from %s to %s" % (installed_version, available_version), file=sys.stderr)
             run(
                 [f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"]
                 + bootctl_flags

pkgs/applications/emulators/libretro/cores/fceumm.nix

···
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2025-09-03";
+  version = "0-unstable-2025-09-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "a5dbb223fc27cc4c7763c977682cfe3b3450d482";
-    hash = "sha256-K52Q9KDMgUUY5kmWNuMcZhib5nPdITMt5hXFyDPX+MU=";
+    rev = "5cd4a43e16a7f3cd35628d481c347a0a98cfdfa2";
+    hash = "sha256-/FvXQlp20QMFg1uPmj2HSJFXhzBunygOmGEtGNGJyxk=";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
     "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
   },
   "mongodbatlas": {
-    "hash": "sha256-IWawVQ+m1NeGqMTrtSE4bH/220tdP2Figqb6yviVEUo=",
+    "hash": "sha256-DaGJHlprTlOfbYmXL0rqbxjbs0azi3aUzdutNv62Kc0=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.40.0",
+    "rev": "v1.41.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XhsoMZc/7zh5AoJtpETVHVvmxSkfMYtJGho+Cy06VMs="
+    "vendorHash": "sha256-bSLbYA6phEi3jvsiSrcWfH1f2/ZdW+9JIA25pDRaDnQ="
   },
   "namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
···
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-iRSd0olC82nr/Uzogg5DsiPAQIVLJRzM2wI9yubs/cw=",
+    "hash": "sha256-PkDugN/y3WmsNdl8+3/3l2tEWilJSEnJPdfkTzCm5mE=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.28.2",
+    "rev": "v3.29.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
···
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-JTQnnJUr6qX1KilrwE1VQi74krq1ci4+iz/8jHaHmXY=",
+    "hash": "sha256-ANr3qJO3LMjqJa6RNjEaEOF7iV0DyqkihAir1FfJWzs=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.156.0",
+    "rev": "v0.158.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LovDyADJeMQpIW3YqrdoNChmRf4XDBZK3DG/oOmtxOI="
+    "vendorHash": "sha256-bmjr1pKK7rVWNa9VF5R/FRxvVJI2Riua9Vdh5pR2p1I="
   }
 }

pkgs/applications/networking/instant-messengers/discord/default.nix

···
       {
         stable = "0.0.108";
         ptb = "0.0.160";
-        canary = "0.0.752";
+        canary = "0.0.756";
         development = "0.0.85";
       }
     else
···
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-6hq0KIXR9j/AHGPyQIXjhf1uJiYizxB5Nu+0unn/frE=";
+        hash = "sha256-jn7s8T04us+9iTcHuM57F4sO10fs98ZjGQa0pF1SFjk=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";

pkgs/applications/networking/seafile-client/default.nix pkgs/by-name/se/seafile-client/package.nix

···
   fetchFromGitHub,
   pkg-config,
   cmake,
-  qttools,
-  qt5compat,
+  qt6,
   libuuid,
   seafile-shared,
   jansson,
   libsearpc,
   withShibboleth ? true,
-  qtwebengine,
-  wrapQtAppsHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "seafile-client";
-  version = "9.0.14";
+  version = "9.0.15";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
-    rev = "v${version}";
-    hash = "sha256-ZMhU0uXAC3tH1e3ktiHhC5YCDwFOnILretPgjYYa9DQ=";
+    tag = "v${version}";
+    hash = "sha256-BV1+9/+ryZB1BQyRJ5JaIU6bbOi4h8vt+V+FQIfUJp8=";
   };
 
   patches = [
···
     libuuid
     pkg-config
     cmake
-    wrapQtAppsHook
-    qttools
+    qt6.wrapQtAppsHook
+    qt6.qttools
   ];
 
   buildInputs = [
-    qt5compat
+    qt6.qt5compat
     seafile-shared
     jansson
     libsearpc
   ]
-  ++ lib.optional withShibboleth qtwebengine;
+  ++ lib.optional withShibboleth qt6.qtwebengine;
 
   cmakeFlags = lib.optional withShibboleth "-DBUILD_SHIBBOLETH_SUPPORT=ON";
 
···
 
   meta = with lib; {
     homepage = "https://github.com/haiwen/seafile-client";
+    changelog = "https://github.com/haiwen/seafile-client/releases/tag/${src.tag}";
     description = "Desktop client for Seafile, the Next-generation Open Source Cloud Storage";
     license = licenses.asl20;
     platforms = platforms.linux;

pkgs/by-name/aw/awscli2/package.nix

···
     less
   ];
 
+  # Prevent breakage when running in a Python environment: https://github.com/NixOS/nixpkgs/issues/47900
+  makeWrapperArgs = [
+    "--unset"
+    "NIX_PYTHONPATH"
+    "--unset"
+    "PYTHONPATH"
+  ];
+
   nativeCheckInputs = with py.pkgs; [
     addBinToPathHook
     jsonschema

pkgs/by-name/bc/bcachefs-tools/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.25.3";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nij4mOJPVA03u6mpyKsFR7vgQ9wihiNfnlSlh6MNXP0=";
+    hash = "sha256-wYlfU4PTcVSPSHbIIDbl8pBOJsBAAl44XBapwFZ528U=";
   };
 
   nativeBuildInputs = [
···
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     src = finalAttrs.src;
-    hash = "sha256-QkpsAQSoCmAihrE5YGzp9DalEQr+2djiPhLTXRn0u6U=";
+    hash = "sha256-ZCzw3cDpQ8fb2jLYdIWrmlNTPStikIs09jx6jzzC2vM=";
   };
 
   makeFlags = [

pkgs/by-name/fo/fosrl-gerbil/package.nix

···
 
 buildGoModule rec {
   pname = "gerbil";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "gerbil";
     tag = version;
-    hash = "sha256-vfeI3GNI910FQmHK53E6yPrWF3tQtjrpQ/oP2PcDzs4=";
+    hash = "sha256-Pnti0agkohRBWQ42cqNOA5TnnSLP9JbOK1eyGf88cao=";
   };
 
-  vendorHash = "sha256-m6UfW+DVT0T/t7fiqZXc2ihg2O07C7LnR0uy4FDWPCA=";
+  vendorHash = "sha256-Sz+49ViQUwJCy7wXDrQf7c76rOZbSGBCgB+Du8T6ug0=";
 
   # patch out the /usr/sbin/iptables
   postPatch = ''

pkgs/by-name/fo/fosrl-newt/package.nix

···
 
 buildGoModule rec {
   pname = "newt";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = version;
-    hash = "sha256-yfQ9w1PKLhdpakZQLnQEcOAxpA4LC4S2OFX4dYKgDKw=";
+    hash = "sha256-wY9zaBDDNqXAAHlFYADS16yp9TOLIIFkjevQL3K0ySE=";
   };
 
-  vendorHash = "sha256-PENsCO2yFxLVZNPgx2OP+gWVNfjJAfXkwWS7tzlm490=";
+  vendorHash = "sha256-XYj2hMsK7Gfrk25bRz/ooDkrXmuUdBQSF/ojF7OTQ4I=";
 
   postPatch = ''
     substituteInPlace main.go \

pkgs/by-name/fz/fzf-make/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "fzf-make";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     rev = "v${version}";
-    hash = "sha256-5/hGTU8jQQvGp0c4FpB29H9wBbae8lVjlohivcVFFwI=";
+    hash = "sha256-XDYJ+R/cQuzSfJyOYHKbbd+jrmAzumDs/wp5aoYEr80=";
   };
 
-  cargoHash = "sha256-Cz0qR24zRXivF3pAo95GNnx8bjUKK96GFnntb68Lz1U=";
+  cargoHash = "sha256-700KyKqrtZ9HuMBZVUbazrGyqzLE4s0ZyrWqLc8Y5WY=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 

pkgs/by-name/is/isa-l/package.nix

···
       # <instantiation>:4:26: error: unexpected token in argument list
       #  movk x7, p4_low_b1, lsl 16
       "aarch64-darwin"
+      # https://github.com/intel/isa-l/issues/188
+      "i686-linux"
     ];
   };
 })

pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix

···
   # "chatgpt-cli" is taken by another package with the same upsteam name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
-  version = "1.8.8";
+  version = "1.8.9";
 
   src = fetchFromGitHub {
     owner = "kardolus";
     repo = "chatgpt-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KdE4TzCkqIzs8xPYflHFpWqpUKqMMxy1YwfNRvyLc08=";
+    hash = "sha256-XC8Uzrm8OjyEvdYArFt6rJJYrXKJeG3QgaOqgUyFNmw=";
   };
 
   vendorHash = null;
   # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.8.8/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.8.9/test/contract/contract_test.go#L35)
   # which will not be the case in the pipeline.
   # Therefore, tests must be skipped.
   doCheck = false;

pkgs/by-name/me/messer-slim/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.0";
+  version = "5.1";
   pname = "messer-slim";
 
   src = fetchFromGitHub {
     owner = "MesserLab";
     repo = "SLiM";
     rev = "v${version}";
-    hash = "sha256-fouZI5Uc8pY7eXD9Tm1C66j3reu7kijTEGA402bOJwc=";
+    hash = "sha256-E1GxHdzY/5bxy8+ur3+/dheDOrmWaOrNcYDNSaY9cMU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/nb/nb/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.20.1";
+  version = "7.21.1";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    hash = "sha256-926M5Tg1XWZR++neCou/uy1RtLeIbqHdA1vHaJv/e9o=";
+    hash = "sha256-d9QhJBRdfTMIDHFOX4/fMmZnqCMeGqQhJTr60Ea7ucw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/pe/peergos/package.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "1.10.0";
+  version = "1.11.0";
   src = fetchFromGitHub {
     owner = "Peergos";
     repo = "web-ui";
     rev = "v${version}";
-    hash = "sha256-L6r0Ut/8HnJO7MYOZsDX7AzntVBTZb5iRKwaFvFKdUs=";
+    hash = "sha256-JUeNNBWzIZlC1+sc1YV+3iPg4PMt+BevG5dDi4JybPk=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/qg/qgv/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qgv";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "gepetto";
     repo = "qgv";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NUMCVqXw7euwxm4vISU8qYFfvV5HbAJsj/IjyxEjCPw=";
+    hash = "sha256-602+CQAScZPNkuudwbRS1NJYYSoQCDwcRJcj8cS/10Q=";
   };
 
   buildInputs = [

pkgs/by-name/ra/radicle-job/package.nix

···
+{
+  lib,
+  rustPlatform,
+  fetchFromRadicle,
+  fetchRadiclePatch,
+  radicle-node,
+  gitMinimal,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "radicle-job";
+  version = "0.3.0";
+
+  src = fetchFromRadicle {
+    seed = "iris.radicle.xyz";
+    repo = "z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
+    tag = "releases/v${finalAttrs.version}";
+    hash = "sha256-6UrkKyIdSM5lSYNF/A3xIf3FGiM2pB/5s7F49jtn0KE=";
+  };
+
+  patches = [
+    # https://app.radicle.xyz/nodes/rosa.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M/patches/dac4fef89d07fe609dd5d3d75ea57f76f1cca3dc
+    (fetchRadiclePatch {
+      inherit (finalAttrs.src) seed repo;
+      revision = "dac4fef89d07fe609dd5d3d75ea57f76f1cca3dc";
+      hash = "sha256-oFUkiBIqAa/DWqlTZw0LzHbgK/uhWik8qbRcGcGpkDY=";
+    })
+  ];
+
+  cargoHash = "sha256-5GjLqs4ol7lUE96KwtE7W3lxL9H/A/0yDpiMDiLQDeY=";
+
+  nativeCheckInputs = [
+    radicle-node
+    gitMinimal
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Create, update, and query Radicle Job Collaborative Objects";
+    homepage = "https://app.radicle.xyz/nodes/iris.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
+    changelog = "https://app.radicle.xyz/nodes/iris.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M/tree/CHANGELOG.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "rad-job";
+  };
+})

pkgs/by-name/ra/radicle-job/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils gnugrep common-updater-scripts nix-update
+
+version=$(list-git-tags | grep -oP '^releases/v\K\d+\.\d+\.\d+$' | sort -rV | head -1)
+nix-update --version="$version" radicle-job

pkgs/by-name/ra/ranger/package.nix

···
 
 python3Packages.buildPythonApplication {
   pname = "ranger";
-  version = "1.9.3-unstable-2025-08-03";
+  version = "1.9.3-unstable-2025-09-10";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ranger";
     repo = "ranger";
-    rev = "760fb03dccdfaeb2e08f3a7f4f867f913af2d74f";
-    hash = "sha256-lnnJz4/xtJZhxOPfJqZq/o7ke9DpaLCcr5dh2M2AbGg=";
+    rev = "3f7a3546e59d52e5de5bbb13b9d9968bfaf6b659";
+    hash = "sha256-a+bfOE0/TfYvyxKjPXo5Q2WKSmfPaM+YJdggjcWFv5I=";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/by-name/so/source-meta-json-schema/package.nix

···
   cmake,
 }:
 let
-  version = "11.1.1";
+  version = "11.8.1";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "source-meta-json-schema";
···
     owner = "sourcemeta";
     repo = "jsonschema";
     rev = "v${version}";
-    hash = "sha256-eXUiRpZko5ZHf2NVQu9HD+FgR3BxcTB9feNeI0kml+4=";
+    hash = "sha256-JfQpjqjZSrOQM0ufccuhKNgxtzkJ+t+QDC8yFd1sTeQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sq/squashfsTools/4k-align.patch

···
-This patch is an old patch; see below for the original message body. The patch
-has been updated several times to be compatible with new releases.
-
- * To apply to squashfs 4.4, commit 52eb4c279cd283ed9802dd1ceb686560b22ffb67.
- * To apply to squashfs 4.5, commit 0496d7c3de3e09da37ba492081c86159806ebb07.
- * To apply to squashfs 4.6, commit f7623b3d9953a1190fec181708c9489ef3522b9f.
-
-From af8a6dca694ddd38d8a775a2b5f9a24fe2d10153 Mon Sep 17 00:00:00 2001
-From: Amin Hassani <[e-mail]>
-Date: Thu, 15 Dec 2016 10:43:15 -0800
-Subject: [PATCH] mksquashfs 4K aligns the files inside the squashfs image
-
-Files inside a squashfs image are not necessarily 4k (4096)
-aligned. This patch starts each file in a 4k aligned address and pads
-zero to the end of the file until it reaches the next 4k aligned
-address. This will not change the size of the compressed
-blocks (especially the last one) and hence it will not change how the
-files are being loaded in kernel or unsquashfs. However on average this
-increases the size of the squashfs image which can be calculated by the
-following formula:
-
-increased_size = (number_of_unfragmented_files_in_image + number of fragments) * 2048
-
-The 4k alignment can be enabled by flag '-4k-align'
----
- squashfs-tools/mksquashfs.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
-index 3429aac..db164c2 100644
---- a/squashfs-tools/mksquashfs.c
-+++ b/squashfs-tools/mksquashfs.c
-@@ -82,6 +82,8 @@ int noI = FALSE;
- int noId = FALSE;
- int noD = FALSE;
- int noX = FALSE;
-+int do_4k_align = FALSE;
-+#define ALIGN_UP(bytes, size) (bytes = (bytes + size - 1) & ~(size - 1))
- 
- /* block size used to build filesystem */
- int block_size = SQUASHFS_FILE_SIZE;
-@@ -1624,6 +1626,9 @@ static void unlock_fragments()
- 	 * queue at this time.
- 	 */
- 	while(!queue_empty(locked_fragment)) {
-+		// 4k align the start of remaining queued fragments.
-+		if(do_4k_align)
-+			ALIGN_UP(bytes, 4096);
- 		write_buffer = queue_get(locked_fragment);
- 		frg = write_buffer->block;	
- 		size = SQUASHFS_COMPRESSED_SIZE_BLOCK(fragment_table[frg].size);
-@@ -2627,6 +2632,9 @@ static void *frag_deflator(void *arg)
- 		write_buffer->size = compressed_size;
- 		pthread_mutex_lock(&fragment_mutex);
- 		if(fragments_locked == FALSE) {
-+			// 4k align the start of each fragment.
-+			if(do_4k_align)
-+				ALIGN_UP(bytes, 4096);
- 			fragment_table[file_buffer->block].size = c_byte;
- 			fragment_table[file_buffer->block].start_block = bytes;
- 			write_buffer->block = bytes;
-@@ -3021,6 +3029,10 @@ static struct file_info *write_file_blocks(int *status, struct dir_ent *dir_ent,
- 	struct file_info *file;
- 	int bl_hash = 0;
- 
-+	// 4k align the start of each file.
-+	if(do_4k_align)
-+		ALIGN_UP(bytes, 4096);
-+
- 	if(pre_duplicate(read_size, dir_ent->inode, read_buffer, &bl_hash))
- 		return write_file_blocks_dup(status, dir_ent, read_buffer, dup, bl_hash);
- 
-@@ -6169,6 +6181,7 @@ static void print_options(FILE *stream, char *name, int total_mem)
- 	fprintf(stream, "or metadata.  This is\n\t\t\tequivalent to ");
- 	fprintf(stream, "specifying -noI -noD -noF and -noX\n");
- 	fprintf(stream, "\nFilesystem build options:\n");
-+	fprintf(stream, "-4k-align\t\tenables 4k alignment of all files\n");
- 	fprintf(stream, "-tar\t\t\tread uncompressed tar file from standard in (stdin)\n");
- 	fprintf(stream, "-no-strip\t\tact like tar, and do not strip leading ");
- 	fprintf(stream, "directories\n\t\t\tfrom source files\n");
-@@ -6690,6 +6703,7 @@ static void print_summary()
- 		"compressed", no_fragments ? "no" : noF ? "uncompressed" :
- 		"compressed", no_xattrs ? "no" : noX ? "uncompressed" :
- 		"compressed", noI || noId ? "uncompressed" : "compressed");
-+	printf("\t4k %saligned\n", do_4k_align ? "" : "un");
- 	printf("\tduplicates are %sremoved\n", duplicate_checking ? "" :
- 		"not ");
- 	printf("Filesystem size %.2f Kbytes (%.2f Mbytes)\n", bytes / 1024.0,
-@@ -8417,6 +8431,8 @@ print_compressor_options:
- 		} else if(strcmp(argv[i], "-comp") == 0) {
- 			/* parsed previously */
- 			i++;
-+		} else if(strcmp(argv[i], "-4k-align") == 0) {
-+			do_4k_align = TRUE;
- 		} else {
- 			ERROR("%s: invalid option\n\n", argv[0]);
- 			print_options(stderr, argv[0], total_mem);
--- 
-2.39.2
-

pkgs/by-name/sq/squashfsTools/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "squashfs";
-  version = "4.6.1";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "plougher";
     repo = "squashfs-tools";
     rev = version;
-    hash = "sha256-fJ+Ijg0cj92abGe80+1swVeZamarVpnPYM7+izcPJ+k=";
+    hash = "sha256-iQ+pBt+jvqI6zgZRV2MZM3CeFqiXe8Z+SS+rLOB4DLw=";
   };
-
-  patches = [
-    # This patch adds an option to pad filesystems (increasing size) in
-    # exchange for better chunking / binary diff calculation.
-    ./4k-align.patch
-  ];
 
   strictDeps = true;
   nativeBuildInputs = [

pkgs/by-name/tl/tlspool/package.nix

···
   p11-kit,
   quickder,
   unbound,
+  openssl,
   gitUpdater,
 }:
 
···
     p11-kit
     quickder
     unbound
+    openssl
   ];
 
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };

pkgs/by-name/tm/tmux/package.nix

···
   runCommand,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
-  withUtf8proc ? true,
+  # broken on i686-linux https://github.com/tmux/tmux/issues/4597
+  withUtf8proc ? !(stdenv.hostPlatform.is32bit),
   utf8proc, # gets Unicode updates faster than glibc
   withUtempter ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl,
   libutempter,

pkgs/by-name/to/toml-sort/package.nix

···
   fetchFromGitHub,
 }:
 let
-  version = "0.24.2";
+  version = "0.24.3";
 in
 python3Packages.buildPythonApplication {
   pname = "toml-sort";
···
     owner = "pappasam";
     repo = "toml-sort";
     tag = "v${version}";
-    hash = "sha256-PuTXG8RIN8Mui5J8DV0yxe94y6FNs4TgPyHjEhpcKqM=";
+    hash = "sha256-QlKksxwgdN37Z6nU1CloUT+G+mRNnkVnbI2++J3R+AY=";
   };
 
   build-system = [ python3Packages.poetry-core ];

pkgs/by-name/tr/trealla/package.nix

···
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.82.9";
+  version = "2.82.33";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2eexWmrVNjfOnK+upPJfUMxE+Xuo5dOyJrEFNGuCapc=";
+    hash = "sha256-NjWvcNE0/FTDTafBpHen06A2UrCA4TBiQWGnDaz/3Yk=";
   };
 
   postPatch = ''

pkgs/by-name/vc/vcpkg-tool/package.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2025-08-29";
+  version = "2025-09-03";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-j+yFC3V+zMJ0UzevVI5L2xNX5+zh/3IyU4NFZRQIf10=";
+    hash = "sha256-mQY5K0dBRWkZooeqRm5X0JXTuD4Xfzs9Vi5j+tbd1aw=";
   };
 
   nativeBuildInputs = [

pkgs/development/ocaml-modules/conan/cli.nix

···
+{
+  buildDunePackage,
+  conan-unix,
+  dune-site,
+  alcotest,
+  conan-database,
+  crowbar,
+  fmt,
+  rresult,
+}:
+
+buildDunePackage {
+  pname = "conan-cli";
+  inherit (conan-unix) version src meta;
+
+  buildInputs = [
+    conan-unix
+    dune-site
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export DUNE_CACHE=disabled
+  '';
+
+  nativeCheckInputs = [ conan-database ];
+
+  checkInputs = [
+    alcotest
+    conan-database
+    crowbar
+    fmt
+    rresult
+  ];
+}

pkgs/development/ocaml-modules/conan/database.nix

···
+{
+  buildDunePackage,
+  conan,
+  alcotest,
+  crowbar,
+  fmt,
+  rresult,
+}:
+
+buildDunePackage {
+  pname = "conan-database";
+  inherit (conan) version src;
+
+  propagatedBuildInputs = [ conan ];
+
+  doCheck = true;
+
+  checkInputs = [
+    alcotest
+    crowbar
+    fmt
+    rresult
+  ];
+
+  meta = conan.meta // {
+    description = "Database of decision trees to recognize MIME type";
+  };
+}

pkgs/development/ocaml-modules/conan/default.nix

···
+{
+  lib,
+  fetchurl,
+  buildDunePackage,
+  version ? "0.0.6",
+  ptime,
+  re,
+  uutf,
+  alcotest,
+  crowbar,
+  fmt,
+  rresult,
+}:
+
+buildDunePackage {
+  pname = "conan";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/conan/releases/download/v${version}/conan-${version}.tbz";
+    hash = "sha256-shAle4gXFf+53L+IZ4yFWewq7yZ5WlMEr9WotLvxHhY=";
+  };
+
+  propagatedBuildInputs = [
+    ptime
+    re
+    uutf
+  ];
+
+  doCheck = true;
+
+  checkInputs = [
+    alcotest
+    crowbar
+    fmt
+    rresult
+  ];
+
+  minimalOCamlVersion = "4.12";
+
+  meta = {
+    description = "Identify type of your file (such as the MIME type)";
+    homepage = "https://github.com/mirage/conan";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/conan/lwt.nix

···
+{
+  buildDunePackage,
+  conan,
+  lwt,
+  bigstringaf,
+  alcotest,
+  crowbar,
+  fmt,
+  rresult,
+}:
+
+buildDunePackage {
+  pname = "conan-lwt";
+  inherit (conan) version src meta;
+
+  propagatedBuildInputs = [
+    conan
+    lwt
+    bigstringaf
+  ];
+
+  doCheck = true;
+
+  checkInputs = [
+    alcotest
+    crowbar
+    fmt
+    rresult
+  ];
+}

pkgs/development/ocaml-modules/conan/unix.nix

···
+{
+  buildDunePackage,
+  fetchpatch,
+  conan,
+  alcotest,
+  crowbar,
+  fmt,
+  rresult,
+}:
+
+buildDunePackage {
+  pname = "conan-unix";
+  inherit (conan) version src meta;
+
+  patches = fetchpatch {
+    url = "https://github.com/mirage/conan/commit/16872a71be3ef2870d32df849e7abcbaec4fe95d.patch";
+    hash = "sha256-/j9nNGOklzNrdIPW7SMNhKln9EMXiXmvPmNRpXc/l/Y=";
+  };
+
+  propagatedBuildInputs = [
+    conan
+  ];
+
+  doCheck = true;
+
+  checkInputs = [
+    alcotest
+    crowbar
+    fmt
+    rresult
+  ];
+}

pkgs/development/python-modules/holistic-trace-analysis/default.nix

···
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  jupyterlab,
+  lib,
+  numpy,
+  pandas,
+  plotly,
+  pydot,
+  pytestCheckHook,
+  setuptools,
+  torch,
+}:
+
+buildPythonPackage rec {
+  pname = "HolisticTraceAnalysis";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "facebookresearch";
+    repo = "HolisticTraceAnalysis";
+    tag = "v${version}";
+    hash = "sha256-3DuoP9gQ0vLlAAJ2uWw/oOEH/DTbn2xulzvqk4W3BiY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    jupyterlab
+    numpy
+    pandas
+    plotly
+    pydot
+    torch
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "hta" ];
+
+  meta = {
+    description = "Performance analysis tool to identify bottlenecks in distributed training workloads";
+    homepage = "https://github.com/facebookresearch/HolisticTraceAnalysis";
+    changelog = "https://github.com/facebookresearch/HolisticTraceAnalysis/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/pytorchviz/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  distutils,
+  fsspec,
+  graphviz,
+  torch,
+  unittestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pytorchviz";
+  version = "0.0.2-unstable-2024-12-30";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "szagoruyko";
+    repo = "pytorchviz";
+    # No tags in the upstream GitHub repo
+    rev = "5cf04c13e601366f6b9cf5939b5af5144d55b887";
+    hash = "sha256-La1X8Y64n/vNGDUEsw1iZ5Mb6/w3WayeWxa62QxLyHA=";
+  };
+
+  dependencies = [
+    graphviz
+    torch
+  ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+    distutils
+    fsspec
+  ];
+
+  unittestFlagsArray = [ "test/" ];
+
+  pythonImportsCheck = [ "torchviz" ];
+
+  meta = {
+    description = "Small package to create visualizations of PyTorch execution graphs";
+    homepage = "https://github.com/szagoruyko/pytorchviz";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}

pkgs/development/python-modules/simplesat/default.nix

···
 
   pythonImportsCheck = [ "simplesat" ];
 
-  preCheck = ''
-    substituteInPlace simplesat/tests/test_pool.py \
-      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
-  '';
-
   enabledTestPaths = [ "simplesat/tests" ];
 
   meta = with lib; {

pkgs/development/python-modules/translate-toolkit/default.nix

···
 
 buildPythonPackage rec {
   pname = "translate-toolkit";
-  version = "3.16.0";
+  version = "3.16.1";
 
   pyproject = true;
 
···
     owner = "translate";
     repo = "translate";
     tag = version;
-    hash = "sha256-KKkYVih2iV/UpizqtYfgu5VPeqzKBJuIc2fzPmePndo=";
+    hash = "sha256-AEMqnTnnbqNsVQY0eE2ATn2NbV9jVPtfCo3Lve7MEmg=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/types-six/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "types-six";
+  version = "1.17.0.20250515";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "types_six";
+    inherit version;
+    hash = "sha256-9PfwOYy3kwTog5czbmQrFelvvqz1uW12Jdo2awadLRg=";
+  };
+
+  build-system = [ setuptools ];
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "six-stubs"
+  ];
+
+  meta = {
+    description = "Typing stubs for six";
+    homepage = "https://github.com/python/typeshed";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ YorikSar ];
+  };
+}

pkgs/os-specific/linux/prl-tools/default.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "26.0.0-57238";
+  version = "26.0.1-57243";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-UuQGW1qYLGVLqAzApPKBqfOZdS23mCPsID4D0HATHNw=";
+    hash = "sha256-jAOP9g3JCKxOFyiDdYJvvM9ecGDbMuCARCEu4sE7Cfs=";
   };
 
   hardeningDisable = [

pkgs/os-specific/linux/systemd/default.nix

···
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isPower64) [
-    # Auto-detect ELF ABI instead of hardcoding ELFv2 for BPF build
-    # Fixes targeting ELFv1
-    # https://github.com/systemd/systemd/pull/38307#issuecomment-3120543119
-    (fetchpatch {
-      name = "0101-systemd-meson.build-Detect-ELF-ABI-version-for-bpf-build-on-ppc64.patch";
-      url = "https://github.com/systemd/systemd/commit/f9509192512a4c4b9e3915a096333d4b6b297956.patch";
-      hash = "sha256-OGUw+hRCKZm+1EcR64M67QJ9c/PbS2Lk/A+1B3q4Jzs=";
-    })
-  ]
   ++ lib.optionals stdenv.hostPlatform.isMusl (
     let
       # NOTE: the master-next branch does not have stable URLs.

pkgs/servers/monitoring/prometheus/nginx-exporter.nix

···
 
 buildGoModule rec {
   pname = "nginx_exporter";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "nginxinc";
     repo = "nginx-prometheus-exporter";
     rev = "v${version}";
-    sha256 = "sha256-V/4h212N1U4wMRt1oL6c1fe/BJH7FVjvx1cSb48mUi0=";
+    sha256 = "sha256-N1+BfuhB0dZ8S88+onVwSiFABnFJjNlIVF/5puCuugs=";
   };
 
-  vendorHash = "sha256-gsdmLg4wtSoY9tg4hDzf4wuCgYEEzopSLJ/7qkVvIzU=";
+  vendorHash = "sha256-sT/hwqKJpQet1NgLuKvJDtB+y6mHCfHABMZ4PJNj490=";
 
   ldflags =
     let

pkgs/top-level/all-packages.nix

···
 
   scantailor-universal = callPackage ../applications/graphics/scantailor/universal.nix { };
 
-  seafile-client = qt6Packages.callPackage ../applications/networking/seafile-client { };
-
   seq66 = qt5.callPackage ../applications/audio/seq66 { };
 
   sfxr-qt = libsForQt5.callPackage ../applications/audio/sfxr-qt { };

pkgs/top-level/ocaml-packages.nix

···
 
         colors = callPackage ../development/ocaml-modules/colors { };
 
+        conan = callPackage ../development/ocaml-modules/conan { };
+
+        conan-cli = callPackage ../development/ocaml-modules/conan/cli.nix { };
+
+        conan-database = callPackage ../development/ocaml-modules/conan/database.nix { };
+
+        conan-lwt = callPackage ../development/ocaml-modules/conan/lwt.nix { };
+
+        conan-unix = callPackage ../development/ocaml-modules/conan/unix.nix { };
+
         conduit = callPackage ../development/ocaml-modules/conduit { };
 
         conduit-async = callPackage ../development/ocaml-modules/conduit/async.nix { };

pkgs/top-level/python-packages.nix

···
 
   holidays = callPackage ../development/python-modules/holidays { };
 
+  holistic-trace-analysis = callPackage ../development/python-modules/holistic-trace-analysis { };
+
   hologram = callPackage ../development/python-modules/hologram { };
 
   holoviews = callPackage ../development/python-modules/holoviews { };
···
 
   pytorch3d = callPackage ../development/python-modules/pytorch3d { };
 
+  pytorchviz = callPackage ../development/python-modules/pytorchviz { };
+
   pytouchline-extended = callPackage ../development/python-modules/pytouchline-extended { };
 
   pytouchlinesl = callPackage ../development/python-modules/pytouchlinesl { };
···
   types-s3transfer = callPackage ../development/python-modules/types-s3transfer { };
 
   types-setuptools = callPackage ../development/python-modules/types-setuptools { };
+
+  types-six = callPackage ../development/python-modules/types-six { };
 
   types-tabulate = callPackage ../development/python-modules/types-tabulate { };